Key Points

  • The Ninth Circuit held that plaintiffs who allege a health plan administrator disclosed sensitive health information it promised to keep confidential have alleged an injury in fact sufficient for Article III standing.
  • The panel found a close historical analogue in breach of confidence, an equitable action recognized in English and American courts around the founding, reinforced by breach of contract, which was actionable at common law without pecuniary injury.
  • The court treated HIPAA's protection of individually identifiable health information as congressional judgment confirming that disclosure of such data is a concrete harm.
  • Because all eight state-law claims rested on the same disclosure, the single injury established standing for each count.
  • The panel distinguished Third, Seventh and Fourth Circuit decisions and declined to decide whether the disclosure-of-private-information tort, on which circuits differ over the publicity element, independently supports standing.

A federal appeals court held on Oct. 9 that members of a health plan whose claims records were emailed to other members without their consent suffered an injury that entitles them to sue, reviving a proposed class action against the plan's administrator.

Judge Eric C. Tung wrote the published opinion for a Ninth Circuit panel that also included Judges Michael Daly Hawkins and William A. Fletcher. The panel reversed U.S. District Judge Amanda K. Brailsford of the District of Idaho, who had dismissed the suit Miles and Melissa Black brought against IEC Group Inc., which does business as AmeriBen. "If you entrust a company to keep your sensitive health information private, but the company then discloses that information to others without your consent, have you been injured?" Judge Tung wrote at the outset. "We hold yes."

The appeal turned on Article III standing, the constitutional rule that a plaintiff must show a concrete injury before a federal court may hear the case. The district court had required a likelihood of future harm. The Ninth Circuit held that the disclosure itself is the injury, because it resembles breaches of confidence and contract that English and American courts recognized around the Constitution's framing.

According to the opinion, AmeriBen wrote to the Blacks in August 2023 that an associate had emailed a spreadsheet containing their sensitive health information to "one or more [plan] members." The data that may have been disclosed included names, provider names, claim numbers, dates of service and amounts billed or paid.

The Blacks filed a proposed class action asserting eight state-law claims, including negligence, breach of contract and breach of fiduciary duty. They alleged that AmeriBen had promised, including through its privacy policy, to keep their information confidential, and that they would not have entrusted it to the company otherwise.

The district court dismissed the suit for lack of jurisdiction, rejecting arguments that the disclosure alone, or the loss of the benefit of the Blacks' bargain, was enough. Reading Ninth Circuit caselaw as "support[ing] a narrower rule," the court required facts that "demonstrate an imminent and substantial injury" and found the Blacks had not alleged such facts.

The panel applied the test of TransUnion LLC v. Ramirez, a 2021 Supreme Court decision that asks whether plaintiffs have identified a "close historical or common-law analogue" for their injury. The panel found it in breach of confidence, an action against a person who discloses nonpublic information learned within a confidential relationship.

Judge Tung traced the action to Edward Coke's 1644 Institutes of the Laws of England, which listed breach of confidence as one of three grounds for equity jurisdiction. The opinion surveyed English chancery cases, including Prince Albert v. Strange, an 1849 dispute over etchings of the royal family, in which the court said that "a breach of trust, confidence, or contract, would of itself entitle the Plaintiff to an injunction."

The panel also cited a 1917 Supreme Court opinion by Justice Holmes, E.I. Du Pont de Nemours Powder Co. v. Masland, which said of a defendant who had learned the plaintiffs' secrets in confidence, "The property may be denied but the confidence cannot be." Judge Tung then summarized the line of cases. "In short: a trust betrayed is the harm," the opinion said.

The opinion acknowledged that the modern privacy tort has nearly eclipsed breach of confidence. "But whether 'breach of confidence' has been overshadowed today is beside the point," Judge Tung wrote, because the action provided a basis for suit around the framing.

Breach of contract reinforced the analogy, the panel said, because confidential relationships are often formed by promises, and the Blacks alleged that AmeriBen broke its promises. "No one can doubt that actions for breach of contract, even without any allegations of pecuniary or physical injury, were available at common law," the opinion said.

The court also pointed to the Health Insurance Portability and Accountability Act, or HIPAA, which gives individuals no right to sue but prohibits disclosure of individually identifiable health information. "However mundane such disclosed data might seem to some—e.g., the patient's name, the provider's name, the dates of service, the amounts billed—Congress made a judgment that such information was sensitive enough to entitle it to statutory protection," Judge Tung wrote.

The opinion offered examples. Daily visits to a psychiatrist could reveal a debilitating mental illness, the court wrote, and time at a fertility clinic could reveal infertility. "Disclosure of such sensitive information resulting from a breach of trust is a harm," the panel held.

The ruling reaches all eight claims. Standing must be shown claim by claim, the panel acknowledged, but "injury in fact turns on the harm a plaintiff has suffered rather than the legal theory he invokes to redress it, and where every count rests on the same injury, that inquiry yields a single answer."

In footnotes, the panel addressed other circuits. The Third Circuit, in Barclift v. Keystone Credit Services, had "hesitate[d] to conclude" that breach of confidence was traditionally recognized, and the Ninth Circuit replied that the action "is anything but new." The Seventh Circuit in Dinerstein v. Google and the Fourth Circuit in Freeman v. Progressive Direct Insurance Co. had questioned whether a contract breach yielding only nominal damages supports standing. The panel called those decisions "readily distinguishable" because they did not involve contractual promises to keep HIPAA-protected health information private.

The panel declined to decide whether a second analogue, the tort of disclosing private information, also supports standing. It noted that circuits differ over whether plaintiffs invoking that tort must allege its "publicity" element.

Jeff Blake of Zimmerman Law Offices PC argued for the Blacks. Darren A. Craig of FBT Gibbons LLP argued for IEC Group.

The Ninth Circuit remanded the case to the District of Idaho for further proceedings. The opinion held that the Blacks have standing "at least at this stage of the pleadings" and did not reach the merits of their claims.